Examkin

Question

Difficulty: MediumAWS CloudFormation

A development team manages their application infrastructure using an AWS CloudFormation stack. A developer needs to update the stack to change the instance type of an Amazon EC2 instance. However, drift detection reveals that the security group attached to the EC2 instance was manually modified out-of-band in the AWS Management Console to allow traffic on port 80808080. In addition, the developer needs to reference a database password that must be automatically rotated.

Which combination of steps should the developer take to resolve the drift and retrieve the password securely and cost-effectively? (Select TWO.)

  1. Update the CloudFormation template to match the drifted security group configuration (allowing port 80808080) before proceeding with the stack update.Answer
  2. Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.Answer
  3. C
    Perform the stack update with the drift synchronization option enabled to automatically rewrite the CloudFormation template based on the live resource configuration.
  4. D
    Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Systems Manager Parameter Store.
  5. E
    Initiate a stack update rollback using the AWS Command Line Interface (AWS CLI) to revert the drifted security group rules to their template-defined values.

Answer

Update the CloudFormation template to match the drifted security group configuration before proceeding with the stack update, and use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.
To resolve the configuration drift where port 80808080 was manually allowed, the developer must update the template to match this state before performing subsequent updates. Additionally, retrieving an automatically rotated database credential is best achieved by storing the credential in AWS Secrets Manager and accessing it using a dynamic reference in the template.

Step-by-Step Solution

1
Analyze the drift detection results for the security group resource.
Identify that port 80808080 was manually allowed out-of-band.
Before performing stack updates, drift must be resolved to prevent update failures or configuration overwrites.
2
Modify the CloudFormation template to include the port 80808080 configuration in the security group resource definition.
The template now matches the live resource configuration.
This aligns the template with the drifted state, resolving the drift status.
3
Implement a dynamic reference using the Secrets Manager resolver pattern in the template to access the database password.
The template references the secret securely without hardcoding it.
Secrets Manager provides native support for automated credential rotation, unlike Systems Manager Parameter Store.

Key Concept

CloudFormation drift resolution and dynamic references for rotated secrets
Rate this question

Topics

AWS CloudFormation

More questions from this topic